The posting
Job Description
The First Line Risk & Control Officer role sits within the first line of defense, working directly with business leaders and control owners and partnering with the second (2LOD) and third (3LOD) Lines of Defense to build and sustain a strong first line risk and control environment.
The role blends two complementary responsibilities. The individual helps shape the function itself by supporting the design of risk and control programs, documenting processes, strengthening the control inventory, establishing assessment cycles, and contributing to reporting that gives leadership a clear view of the risk profile. In equal measure, the individual manages risk in a live operating environment by driving issues to timely closure, escalating and analyzing operational risk events, responding to regulatory and audit inquiries, and serving as a trusted risk partner to the business.
The officer is accountable for the first line risk and control coverage on a defined portfolio of businesses. That consists of elements such as the issues, the operational risk events, the control documentation, the assessment cycle, and the analysis leadership uses for those businesses. The judgments are the officer's: severity, whether the root cause is sufficient, whether the action plan will close the gap, and when a late owner or a material exposure gets escalated.
ESSENTIAL DUTIES AND RESPONSIBILITIES
• Issues management. Execute the first line issue lifecycle for assigned areas, Validate the issue, complete root cause with the owner, design the action plan, and judge whether both are sufficient before the item goes to the second line. Escalate missed dates and material exposure to the business leader, assemble closure evidence, and confirm the fix held. Run the issue owner meetings for those businesses. Closed items have to withstand second line challenge, audit, and examination.
• Risk event management. Accountable for capture, triage, and escalation of operational risk events in assigned businesses, including the call on threshold and timeline. Complete root cause, decide when a failed or missing control becomes an issue, and put a loss or near-miss figure on the event so priority is visible. Produce the thematic read for those businesses and the control response that follows from it.
• Risk and control self-assessment (RCSA). Accountable for completing the assessment for assigned risk assessable units on the enterprise cadence, under the enterprise methodology. Document the process universe, map process to risk to control, facilitate the residual rating with the owner, and compare that rating to recent events and open issues. The business owns the rating. The officer owns a documented assessment, with gaps in remediation.
• Controls management. Apply first line control standards, prioritizing higher-risk controls; document control design; confirm accountable owners; maintain inventory accuracy in the system of record; and support assessment of design and operating effectiveness.
• Business partnership and proactive risk identification. Serve as the day-to-day first line risk partner to the leaders of assigned businesses. Carry the risk themes across that portfolio and identify emerging risk before it is an event, using indicators, loss trends, and process knowledge. Raise it while decisions on campaigns, process changes, and channel changes are still open.
• Regulatory and audit engagement. Prepare the first line response for examinations, internal audit, findings, and regulatory change in assigned businesses, and defend that material in the working sessions. Assess how the finding or the change affects the risks and controls in the portfolio.
• Reporting, indicators, and risk culture. Contribute to recurring risk reporting and Risk and Control Forum materials for senior leadership and second line partners, monitor risk and control indicators, and promote ownership of risk responsibilities among first line associates.
· Product and process change. Complete the first line risk assessment with the business, under the enterprise process, for new, expanded, and modified products and for material process changes in assigned businesses. Scope the change with the owner, map the risks and controls, and record residual risk before the change goes live.
SUPERVISORY RESPONSIBILITIES
1. No supervisory responsibilities
QUALIFICATIONS
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Additionally, the qualifications listed below are representative of the knowledge, skills, and/or abilities required in this position:
• 8 - 10 years of direct related experience in banking or a regulated financial institution, including at least five years of hands-on experience in risk management, risk and control, or a comparable control discipline, including direct, hands-on ownership of issues management or risk and control self-assessment (RCSA).
• Proficiency across the first line risk and control toolkit, at a level that produces finished work: issue lifecycle and remediation management, risk event and loss data management, control design documentation and test logic, risk and control self-assessment, and regulatory and audit response.
• Demonstrated ability to perform root cause analysis and author corrective action plans accepted by a second line risk function, internal audit, or a regulator.
• Consumer banking, small business banking, or consumer lending knowledge sufficient to trace a loss or a near miss to the deposit, payment, digital channel, fraud, origination, or servicing process that produced it, and to discuss that process with the owner.
• Knowledge of the three lines of defense model and the boundary between first line execution and second line oversight, with the ability to influence business leaders and control owners without direct authority and to write analysis that senior leadership, audit, and regulators can rely on as the record..
PREFERRED QUALIFICATIONS
• Experience inside a first line risk and control or business control function.
• Second line operational risk, First line Risk Management, internal audit, or regulatory examination background, and a clear view of what good looks like from that side of the table.
• Experience in a risk and control function that was growing, scaling, or modernizing.
• Familiarity with the risk domains concentrated in a consumer banking profile, including external fraud, manual processing error, technology and third-party dependence, data quality, and workforce and incentive risk.
• Experience building or mapping a risk, control, or process taxonomy, and comfort applying automation and analytics to control testing and monitoring by designing test logic rather than executing tests manually.
• Professional certification such as CRCM, CIA, CRMA, CAMS, PRM, or an equivalent.
Education Required
1. Bachelor (4-year college) degree
Years of experience required.
8-10 years of directly related experience including 5+ years of direct experience in risk management or first line risk and control, or equivalent combination of education and experience
COMPUTER AND OFFICE EQUIPMENT SKILLS
Indicate the software experience required or preferred
1. Microsoft Office suite
2. Special software: list any special software
